GuideIntermediate
Authentication & Authorization Guide
This guide teaches you how to implement complete authentication and authorization: password hashing, JWT tokens, OAuth2 flows, RBAC with roles and permissions, security headers, and FastAPI's native Security integration.
- 48
- lessons
- 6
- modules
- English · Spanish
- available in
- Yes
- certificate
- Free
- access
Outcomes
What you'll be able to do
- Password Security: bcrypt, argon2, hashing vs encryption
- JWT: Token generation, validation, refresh tokens, expiration
- OAuth2: Password flow, authorization code flow, FastAPI Security
- RBAC: Role-based access control, granular permissions
- Security Headers: HSTS, CSP, X-Frame-Options
- API Keys: Service-to-service authentication
- Session Management: Stateful vs stateless, token invalidation
Before you start
What you need to bring
Requirements and materials
- FastAPI Fundamentals and Advanced completed
- PostgreSQL & SQLAlchemy Guide completed
- A users table with its SQLAlchemy model
Content
The syllabus, module by module
Open any of them to see its lessons.
- Module 1: Password Security — Introduction
- Capsule 02: Hashing vs Encryption — The difference that changes everything
- Capsule 03: pwdlib in Python with argon2id
- Capsule 04: Automatic salt and timing attacks
- Capsule 05: argon2 vs bcrypt — Technical comparison
- Capsule 06: Password validation that doesn't scare users away
- Capsule 07: Data breach scenarios — what happens if your DB is stolen
- Capsule 08: Project — Complete user registration
- Module 2: JWT Tokens — Introduction
- Capsule 02: Anatomy of a JWT — Header, Payload, Signature
- Capsule 03: Generating tokens with PyJWT
- Capsule 04: Validating and decoding tokens
- Capsule 05: Access tokens vs Refresh tokens
- Capsule 06: Token revocation — when a token "expires" before its expiration
- Capsule 07: Secure secret keys
- Capsule 08: Project — Complete JWT login
- Module 3: OAuth2 and FastAPI Security — Introduction
- Capsule 02: OAuth2PasswordBearer — Setup
- Capsule 03: get_current_user — the dependency, broken down
- Capsule 04: Protecting endpoints with Depends
- Capsule 05: HTTPBearer vs OAuth2PasswordBearer
- Capsule 06: OAuth2 scopes — Fine-grained permissions
- Capsule 07: Error handling — 401 Unauthorized vs 403 Forbidden
- Capsule 08: Project — Protected blog endpoints
- Module 5: Security Headers and Sessions — Introduction
- Capsule 02: Security headers
- Capsule 03: API key authentication
- Capsule 04: Stateful vs Stateless authentication
- Capsule 05: Token blacklist and real logout
- Capsule 06: Basic rate limiting
- Capsule 07: OWASP Top 10 for APIs
- Capsule 08: Project — hardened API
- Module 6: Complete Auth System Project — Introduction
- Capsule 02: Auth System Architecture
- Capsule 03: Complete flows with tracing
- Capsule 04: Final integrated RBAC
- Capsule 05: Complete error handling
- Capsule 06: End-to-end integration tests
- Capsule 07: API Documentation
- Capsule 08: Final Project — Production-Ready Auth System
Where it fits
This guide is part of something bigger
It's studied inside these programs, with support and dates.
Common questions
What people usually ask
No limit. It's a free guide: come in whenever you like, as often as you like.
No. Modules run from easier to harder, but you can jump to the one you need. Progress is saved per lesson.
Whatever is needed is listed under “What you need to bring”, above. If nothing is listed there, you can start from zero.
In the Club's WhatsApp group, and every two weeks there's a live with an instructor where questions get worked through.
Yes. It's issued automatically once you finish every lesson, with a verifiable code you can share on LinkedIn.
No. This guide is self-paced with no dates. The bootcamp is live, by cohort, with work someone reviews.
Start whenever you like
What students say
These reviews are from enrolled students who completed at least 50% of the course. We moderate reviews only on content grounds (spam, offensive language, personal data), never for being critical or negative.
No approved reviews yet.
Be the first to share your experience!